The AI Rulebook Has Arrived: What EU, Swiss and UK Law Now Expects From You

In July 2026, the EU quietly rewrote its own AI deadlines. The heavyweight obligations for high-risk AI systems moved from August 2026 to December 2027. Many executives read the headline and relaxed. That is the wrong reaction. Parts of the EU AI Act already apply to almost every company using AI today, and most organizations are already breaching at least one of them. Meanwhile Switzerland chose a completely different path, and the UK a third one. If your company operates across these borders, you are now managing three rulebooks at once. This article explains all three in plain language, what applies today, what comes next, and where to start.

One term to know before we start. The EU AI Act does not treat all AI the same. It sorts AI uses into risk tiers: banned uses, high-risk uses, uses that only require transparency, and everything else. Which tier your AI falls into decides which duties you carry. Most of the confusion about the Act disappears once you think in tiers.

Part I · What the EU AI Act Requires

The EU AI Act: Four Risk Tiers and the Deadlines for Each

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI law. It applies to any organization that places an AI system on the EU market or whose AI output is used in the EU. That includes companies based outside the EU (Art. 2(1)(c)). A Swiss bank or a UK retailer serving EU customers is covered, whether it likes it or not.

Tier 1: Banned practices. These are AI uses that no amount of paperwork can make legal. They include software that reads employees' emotions at work or school, social scoring that rates people as more or less trustworthy based on unrelated behavior, and scraping the internet for faces to build recognition databases. The legal basis is Article 5. The deadline has already passed: these bans have applied since 2 February 2025, and a further set arrives on 2 December 2026, including a ban on AI that generates non-consensual intimate imagery. Penalties reach 35 million euros or 7% of global turnover, the highest tier in the Act.

Tier 2: High-risk AI. These uses are allowed, but they come with serious homework. The category covers AI that helps decide who gets hired, who gets a loan, who gets life or health insurance, and who qualifies for public benefits, plus biometric identification, exam scoring and proctoring, and safety components in critical infrastructure such as power grids. The legal basis is Article 6 with Annex III, and the duties themselves sit in Articles 8 to 15: a risk management system, data governance, technical documentation, human oversight, logging, and conformity assessment. This is the tier the Digital Omnibus moved. The deadline is now 2 December 2027 for stand-alone systems, and 2 August 2028 for AI embedded in regulated products such as medical devices.

Tier 3: Transparency obligations. These uses are allowed, but you must tell people that AI is involved. Chatbots have to disclose that they are chatbots, and AI-generated images, audio, video and text published externally have to be labeled. The legal basis is Article 50. The deadline is 2 August 2026, which means these duties are live now. They are the cheapest obligations in the entire Act to meet, and the most publicly embarrassing to miss, because every customer can see them.

Tier 4: General-purpose AI. This tier applies to organizations that build or fine-tune foundation models that other people then use. It does not apply to companies that simply use ChatGPT or a similar tool. The duties cover transparency, a copyright policy, and published summaries of training data, and they sit in Articles 51 to 55. The deadline has already passed: these obligations have applied since 2 August 2025.

Everything that falls outside these four tiers is treated as minimal risk and carries no specific obligations under the Act. But two duties reach almost everyone regardless of tier: the AI literacy requirement in Article 4, and, wherever personal data is involved, the GDPR.

The Digital Omnibus, adopted in mid-2026, gave companies more time on high-risk obligations. It did not soften them. The requirements are unchanged, and the runway is only valuable if you use it. Documentation, data governance and oversight structures take longer than a year to build properly, which is roughly the time now left.

Part II · What Swiss Law Requires

Switzerland: No AI Act, but the FADP and FINMA Already Bind You

Switzerland looked at the EU's approach and deliberately chose a different one. In February 2025, the Federal Council decided against a horizontal Swiss AI law. Instead, Switzerland will regulate sector by sector, using existing law, and will ratify the Council of Europe's AI Convention (CETS No. 225), the first binding international treaty on AI and human rights. A consultation bill implementing the convention is expected by the end of 2026, covering transparency, data protection, non-discrimination and supervision.

No AI Act does not mean no rules. Three instruments already do real work today.

1. The revised Federal Act on Data Protection (FADP). In force since September 2023, it applies directly to any AI that processes personal data, and the federal data protection authority, the FDPIC, has said so explicitly. It gives people rights around automated individual decisions (Art. 21) and requires impact assessments for high-risk processing (Art. 22). If your AI touches personal data, this already binds you.

2. FINMA Guidance 08/2024, for banks and insurers. Supervised financial institutions are already expected to maintain an AI inventory and risk classification, test and monitor their models, keep documentation, provide explainability, and assign clear accountability. In practice, Swiss financial firms have AI governance obligations today, ahead of any AI statute.

3. General law that reaches AI-driven harm. Unfair competition rules, product liability, and anti-discrimination provisions all apply to damage caused by an AI system, exactly as they would to any other business decision. No AI-specific law is needed for a customer to bring a claim.

The Swiss bet is that existing law, applied firmly, ages better than a big new statute. It keeps compliance lighter for most companies. But it leaves one trap: Swiss firms serving EU customers still fall under the EU AI Act, and some assume they do not.

Bernard Millet, DataEdgePro.net

Part III · What UK and National Regulators Require

The UK: Five Principles Enforced by Your Sector Regulator

The UK also has no AI Act, and none is coming in the short term. Its 2023 White Paper set out five principles instead, which existing regulators apply within their own sectors.

1. Safety, security and robustness. AI systems should work reliably and securely throughout their life, and should not create new safety risks for the people who rely on them.

2. Appropriate transparency and explainability. People affected by an AI decision should be able to find out that AI was involved and to get an explanation they can actually understand.

3. Fairness. AI should not produce discriminatory outcomes or undermine people's legal rights. The Equality Act 2010 is the backstop here.

4. Accountability and governance. Someone must be answerable for each AI system, with real oversight in place rather than an assumption that the technology governs itself.

5. Contestability and redress. People need a route to challenge an AI-driven decision that affects them, and to obtain a remedy when it is wrong.

Enforcement is spread across the regulators you already deal with. The ICO covers data, the FCA covers financial services, the CMA covers competition, and the MHRA covers medical products. In January 2026 the government asked 19 regulators to publish plans for how they will supervise AI in their sectors. For personal data, UK GDPR and the Data Protection Act 2018 do the heavy lifting, including the rules on automated decisions. The one new law on the horizon, the Regulating for Growth Bill, creates regulatory sandboxes (the "AI Growth Lab") rather than general AI obligations.

For a company, the practical consequence is this: in the UK you will not be asked "are you AI Act compliant?". You will be asked by your sector regulator whether your AI is fair, explained, and governed. The evidence you need looks remarkably similar to what the EU demands. Good governance travels well across borders.

Who Enforces the AI Act in Germany, France, Italy, Spain and the Netherlands

A common misunderstanding is that the EU AI Act comes with one European enforcer. It does not. Each member state appoints its own authorities and sets its own penalties within the EU framework, and roughly 24 of the 27 have now done so. Here are the main markets.

Germany. Enforcement sits with the Federal Network Agency (BNetzA), the same regulator that oversees telecoms and energy networks. A national implementation law is working its way through the legislative process.

France. The notable gap. As of mid-2026, France had still not formally designated its authorities, though the data protection regulator CNIL is widely expected to take the lead role.

Italy. The furthest ahead. Italy passed its own national AI law (Law 132/2025), the first in Europe to complement the EU Act. AgID accredits assessment bodies, and the national cybersecurity agency ACN supervises and sanctions.

Spain. The only country to build a dedicated agency from scratch: AESIA, the Spanish AI Supervisory Agency, working alongside the data protection authority AEPD.

The Netherlands. The job went to the Authority for Digital Infrastructure (RDI), coordinating with the Dutch data protection authority.

Poland, Belgium and Ireland. Poland created a new central AI commission (KRiBSI) as its single market surveillance authority. Belgium and Ireland took the opposite approach and spread enforcement across many existing sector regulators.

The practical point is simple. The obligations are identical wherever you operate, but the authority that knocks on your door, and the speed at which it does, is a national matter. If you operate in a specific country, knowing your enforcer is part of knowing your law.

Part IV · What to Do Next

Five Moves That Satisfy EU, Swiss and UK Regulators at Once

The good news hiding in this complexity: the three regimes reward the same underlying work. Evidence of good governance satisfies Brussels, Bern and London alike. Five moves cover most of it.

1. List every AI system you use, including the hidden ones. You cannot govern what you cannot see, and most organizations see maybe half of their AI. List what your teams built, what came embedded in purchased software, and what employees use unofficially. Records duties in GDPR (Art. 30) and the FADP (Art. 12) point the same way.

2. Assign each AI use to an EU risk tier. Map your inventory against the four categories: banned, high-risk, transparency, minimal. The EU tiers are the strictest framework and reach across borders, so they make a sensible common denominator even for Swiss and UK operations.

3. Train your staff and label your chatbots this quarter. AI literacy training (Art. 4) and transparency disclosures (Art. 50) are the two obligations that already apply, cost little, and are visibly absent when missed. Neither requires a consultant.

4. Name one person accountable for AI risk. A named owner, a committee with real decision rights, and a policy set. FINMA expects it of Swiss financial firms today, the EU requires it for high-risk systems, and UK regulators ask for it under the accountability principle.

5. Build your documentation before December 2027, not during it. The deadline is workable if technical files, data governance and human oversight get built now. Retrofitting documentation under deadline pressure is far more expensive. ISO/IEC 42001, the management-system standard for AI, gives you a defensible blueprint.

Conclusion

Three jurisdictions, three philosophies. The EU wrote one big law with tiers and deadlines. Switzerland is betting on existing law plus an international convention. The UK trusts its sector regulators to apply five principles.

Underneath those differences, all three ask the same four questions. Do you know where your AI is? Do you know what it decides? Can a human intervene? And can you prove all of the above? An organization that can answer those questions is in decent shape in Brussels, Bern and London alike.

The Digital Omnibus bought companies time, not absolution. The obligations that matter most right now, literacy and transparency, are also the cheapest to meet. The expensive ones have a fixed date in December 2027. Organizations that treat the next sixteen months as building time will be fine. Organizations that treat the delay as a reason to look away will meet the same requirements later, at a worse price.

The practical starting point is knowing your own gap, and that is harder than it sounds. Reading about four risk tiers is one thing. Working out which of your own AI systems fall into them, and how far your current governance sits from what each tier demands, is another.